Balancer v2 exploit post-mortem reveals rounding flaw in stable pool invariant — attacker manipulated batch-swaps to distort BPT pricing and drain funds, echoing prior Bunni rounding bug warnings about Solidity’s math limits.

𝕏/@moo9000 •

Revision history

2 recorded changes

Want your article here?

"An attacker manipulated exchange rates in Balancer V2 stable pools by issuing a long, alternating batch‑swap sequence that exploited rounding in the stable invariant. The sequence produced an underestimation of the invariant D, which reduced the implied BPT price. Proceeds accumulated as internal balances and were withdrawn in a subsequent transaction."

Top comment by @Spencer420

Balancer v2 exploit post-mortem reveals rounding flaw in stable pool invariant — attacker manipulated batch-swaps to distort BPT pricing and drain funds, echoing prior Bunni rounding bug warnings about Solidity’s math limits.

More on Post-Mortem

Stake DAO finalizing post-mortem and proposal to compensate affected users

LayerZero publishes a detailed April 18 incident post-mortem with Mandiant and CrowdStrike, hardens partner security, highlights continued usage and TVL, and doubles down on modular, app-controlled security.

LayerZero issues overdue apology for poor communication during post-mortem process

Post-mortem shows eth.limo DNS attack stemmed from impersonation at EasyDNS, as rapid response and DNSSEC safeguards helped contain potential damage

Rhea Finance exploit losses surge to $18.4M after post-mortem, as attackers manipulated liquidity pools using fake tokens

Zerion details post-mortem of targeted AI-driven breach, partners with Blockaid, ZeroShadow & ChainPatrol to trace funds and boost defenses

Stake DAO finalizing post-mortem and proposal to compensate affected users

LayerZero publishes a detailed April 18 incident post-mortem with Mandiant and CrowdStrike, hardens partner security, highlights continued usage and TVL, and doubles down on modular, app-controlled security.

LayerZero issues overdue apology for poor communication during post-mortem process

Post-mortem shows eth.limo DNS attack stemmed from impersonation at EasyDNS, as rapid response and DNSSEC safeguards helped contain potential damage

Rhea Finance exploit losses surge to $18.4M after post-mortem, as attackers manipulated liquidity pools using fake tokens

Zerion details post-mortem of targeted AI-driven breach, partners with Blockaid, ZeroShadow & ChainPatrol to trace funds and boost defenses

Total stats

How to Earn

Balancer v2 exploit post-mortem reveals rounding flaw in stable pool invariant — attacker manipulated batch-swaps to distort BPT pricing and drain funds, echoing prior Bunni rounding bug warnings about Solidity’s math limits.

More on Post-Mortem

Stake DAO finalizing post-mortem and proposal to compensate affected users

LayerZero publishes a detailed April 18 incident post-mortem with Mandiant and CrowdStrike, hardens partner security, highlights continued usage and TVL, and doubles down on modular, app-controlled security.

LayerZero issues overdue apology for poor communication during post-mortem process

Post-mortem shows eth.limo DNS attack stemmed from impersonation at EasyDNS, as rapid response and DNSSEC safeguards helped contain potential damage

Rhea Finance exploit losses surge to $18.4M after post-mortem, as attackers manipulated liquidity pools using fake tokens

Zerion details post-mortem of targeted AI-driven breach, partners with Blockaid, ZeroShadow & ChainPatrol to trace funds and boost defenses

Stake DAO finalizing post-mortem and proposal to compensate affected users

LayerZero publishes a detailed April 18 incident post-mortem with Mandiant and CrowdStrike, hardens partner security, highlights continued usage and TVL, and doubles down on modular, app-controlled security.

LayerZero issues overdue apology for poor communication during post-mortem process

Post-mortem shows eth.limo DNS attack stemmed from impersonation at EasyDNS, as rapid response and DNSSEC safeguards helped contain potential damage

Rhea Finance exploit losses surge to $18.4M after post-mortem, as attackers manipulated liquidity pools using fake tokens

Zerion details post-mortem of targeted AI-driven breach, partners with Blockaid, ZeroShadow & ChainPatrol to trace funds and boost defenses

Comments

Total stats

How to Earn